US 2021/0273957 A1 · CYBER SECURITY FOR SOFTWARE-AS-A-SERVICE FACTORING RISK

Abstract

A cyber threat defense system can incorporate data from multiple Software-as-a-Service (SaaS) applications hosted by multiple third-party platforms to identify cyber threats across platforms. The system can collect third-party event data describing an administrative event of a SaaS application hosted by an associated third-party platform. The system can identify a user associated with the third-party event data based on a composite user profile constructed from user context data collected across the multiple SaaS applications to identify the user across multiple third-party platforms. The system can associate the user with a user risk profile based on the composite user profile. The system can identify whether the third-party event data corresponds to a cyber threat partially based on the user risk profile. The system can execute an autonomous response in response to the cyber threat using an autonomous response module factoring in the user risk profile.

Claims20

Dependent claims

A method for a cyber threat defense system incorporating data across multiple Software-as-a-Service (SaaS) applications hosted by multiple third-party platforms to identify cyber threats related to that SaaS application, comprising:

collecting at one or more SaaS modules, from one or more network devices that utilizes one or more SaaS applications, third-party event data describing an administrative event of a SaaS application hosted by an associated third-party platform;
identifying a user associated with the third-party event data based on a composite user profile constructed from user context data collected across the multiple SaaS applications to identify the user across multiple third-party platforms;
associating the user with a user risk profile based on the composite user profile;
identifying whether the third-party event data corresponds to a cyber threat partially based on the user risk profile;
and
executing an autonomous response in response to the cyber threat using an autonomous response module factoring in the user risk profile.

3 more elements

An apparatus for a cyber threat defense system, comprising:

a coordinator module configured to contextualize third-party event data from one or more software-as-a-service (SaaS) modules with probe data from one or more probe modules to create a combined data set for analysis;
a context gatherer for one or more SaaS modules configured to collect user context data from multiple third-party platforms executing SaaS applications to identify a user, which is used in creating a composite user profile;
a risk profile module configured to associate the user with a user risk profile based on the composite user profile;
and
an autonomous response module configured to execute at least one autonomous response to a cyber threat identified by a cyber threat module, wherein a first autonomous response factors in the user risk profile from the risk profile module.

2 more elements

Dependencies are inferred from the claim text.

Cyber security for software-as-a-service factoring risk

Life of this patent

Cyber security for software-as-a-service factoring risk

Life of this patent

Abstract

Claims20